What changed, and when.
- 13 Nov 2025MAS consults on Guidelines on AI Risk Management (P017-2025), covering generative AI and AI agents.
- 7 Oct 2026Final guidelines issued, with MAS’s response to the feedback.
- Oct 2027Twelve months on: oversight, identification of AI uses, an inventory and risk assessments in place.
- Oct 2028Twenty-four months on: full implementation. Higher-risk uses as soon as possible.
In MAS’s words.
“Controls should be applied with greater rigour for use cases of higher risk materiality, such as credit scoring, insurance underwriting, and the provision of financial advisory or fund management services.”
MAS also expects a rule even at firms that say they don’t use AI, because their staff probably do. At para 3.14, firms should set “policies that clearly set out whether and how AI may be used by staff, to manage risks arising from any unauthorised use of AI (such as ‘shadow AI’)”.
On timing, para 13.5 gives twelve months for the first sections of the Guidelines and twenty-four for full implementation, and adds that “an FI should apply appropriate lifecycle controls for its high risk use cases as soon as possible”.
“Privacy risks, e.g., arising from the leakage of confidential or customer data due to the use of third-party Generative AI products or services.”
What it requires.
- 1An accurate, up-to-date inventory of AI use cases, systems and models, each rated for risk.
- 2Oversight of AI risk by the board and senior management.
- 3A written rule on whether and how staff may use AI.
- 4Lifecycle controls on data, human oversight and third-party AI, applied with more rigour to higher-risk uses such as fund management.
What it means on a research desk.
For an asset manager, research is where AI use spreads first and is documented last. AIMA’s 2025 survey of 150 managers found that half of those under US$1 billion had no restrictions on staff using generative AI tools, and that 29% of investors already ask about generative AI in due diligence questionnaires, with a further 29% planning to.
- 1Know every AI tool the desk uses, and rate each for risk.
- 2Keep a record of what was asked, what was answered, and who checked it.
- 3Keep confidential documents, positions and client data out of third-party AI products the firm doesn’t control.
How Core answers each requirement.
- An inventory and risk records
- An inspection pack in one download: the model card, controls, the use-case inventory and the answer log, framed on the SFC’s principles.
- Human oversight
- Every figure cites its source page, and a figure with no source is flagged, so the reviewer checks numbers in one click instead of retyping them.
- A record of every answer
- Each Ask answer is logged with the model, where it ran, its sources and who reviewed it. The log is kept on the machine in your office.
- Third-party AI and data leakage
- Core runs on hardware your firm owns, in your office, and your documents stay on it. What leaves depends on the setup, and we state it for each: on a Mac mini, questions go to a cloud model under your own agreement.
- A sanctioned tool for staff
- One tool the policy can name: the desk asks Core instead of pasting research into public chatbots, and Core can use Claude, GPT or Gemini under your own agreement.
This is a summary of public documents, not legal advice. Check how they apply to your firm with your compliance team.
Questions.
When did MAS issue the Guidelines on AI Risk Management?
MAS issued the final Guidelines on 7 October 2026, with its response to feedback on consultation paper P017-2025 of 13 November 2025.
Is fund management a higher-risk use under the MAS guidelines?
Yes. Para 3.10 of MAS’s response says controls should be applied with greater rigour for use cases of higher risk materiality, and names the provision of financial advisory or fund management services among them.
How long do firms have to comply?
Para 13.5 of the response gives twelve months for oversight, identification, the inventory and risk assessments, and twenty-four months for full implementation. Higher-risk uses should get lifecycle controls as soon as possible.
What does MAS say about shadow AI?
Para 3.14 of the response expects policies that clearly set out whether and how AI may be used by staff, to manage risks arising from any unauthorised use of AI, such as shadow AI. It applies even to firms that have not adopted AI themselves.
